[Equipment] Warning: Malware found on Contec RS01

[gnluna]

Hello,

I want to warn everybody that malware was on the Contec RS01 I got recently. The device connects to a computer as a normal mass storage device, and there was an autorun.inf and another file under RECYCLER. Kaspersky identified both as malware. I don't think the files are used by the RS01. Parts of both files were identified since 2010, so hopefully most anti-virus software will catch it. Disabling autorun on your computer is also a good idea if you don't want to rely on your anti-virus app.

There is no way to be certain when or how it happened. My RS01 was not ordered directly from Contec, but this naturally casts a shadow on them.

[SleepyCPAP]

Thanks for the warning.

I was just starting to research this device today, as my sleep apnea is being treated mostly by my new AlaxoStent, and I’m wondering if there is a way to monitor my nighttime breathing without masking up. I’m not stopping my combined AlaxoStent-and-PAP therapy yet, but I’m about to reduce to 4cm and maybe monitoring what the stent is doing without _any_ PAP would be useful in the near future.

- SleepyCPAP

[Crimson Nape]

Was the malware on the device itself, or was it on the supplied CD?

[gnluna]

The malware was on the device itself. No CD was included. I have not tried the software at the link provided by the kit.

I feel bad that this will turn people away because I otherwise like my RS01, and I've started a thread about getting it supported by OSCAR.

[desaturator]

What is the actual malware involved here? Are there filenames that would help to identify it? Are you sure your virus checker hasn't raised a false positive?

Could the unit have been other than brand new when you got it?

[gnluna]

What is the actual malware involved here? Are there filenames that would help to identify it? Are you sure your virus checker hasn't raised a false positive?

I would not suggest using filenames to detect malware.

For one file, VirusTotal says 39 of 57 anti-malware programs detected the file.
Kaspersky identified the threats as:
Net-Worm.Win32.Kido.ir ( https://threats.kaspersky.com/en/threat/...32.Kido.ir )
Trojan.Win32.VB.awcn ( https://threats.kaspersky.com/en/threat/...32.VB.awcn )
 
For the other file, VirusTotal says 63 of 68 anti-malware programs detected the file.
Kaspersky identified the threats as:
BSS:Trojan.Win32.Bazon.a ( https://threats.kaspersky.com/en/threat/...32.Bazon.a )
Net-Worm.Win32.Kido.ih ( https://threats.kaspersky.com/en/threat/...32.Generic )
HEUR:Worm.Win32.Generic ( https://threats.kaspersky.com/en/threat/...32.Generic )
HEUR:Trojan.Win32.Generic ( https://threats.kaspersky.com/en/threat/...32.Kido.ih )

Could the unit have been other than brand new when you got it?

Of course.

[selfcoacher]

https://www.virustotal.com/gui/file/0698...886906da38

Their installation resmon software file generates no warnings for me. You are saying there are files on the actual device that are malware?

[gnluna]

https://www.virustotal.com/gui/file/0698...886906da38

Their installation resmon software file generates no warnings for me.  You are saying there are files on the actual device that are malware?

That's good news about ResMon.

I found malware on my device. I am not claiming that anyone else should expect malware on their RS01. There is simply not enough known at this time.

[Jeff8356]

Just curious, did you buy this unit from an individual or from an online retailer?

[gnluna]

I bought online from a seller that deals almost exclusively in Contec stuff and has available and/or has sold a number of many listed products.